• Kiran Patil's avatar
    [SCSI] tcm_fc: Fixing reference counting problem which was causing ft_sess to be deleted. · f2f7b09c
    Kiran Patil authored
    Problem: After fixing the issue in TCM core w.r.t LUN Reset (Task
    Management request) , ran into issue where during the completing of
    this LUN Reset command, reference count of "ft_sess" drops to zero
    which caused "sess" to be deleted.
    
    Fix: As part of handling task management request (e.g. LUN Reset), TCM
    core function "transport_generic_do_tmr" ends up calling ft_free_cmd
    which in turn calls "ft_sess_put" (which drops session's reference
    count by 1) and then frees ft_cmd. Then function
    "transport_generic_do_tmr" calls "transport_cmd_check_stop" which in
    turn also calls ft_free_cmd (which calls ft_sess_put - which drops
    reference count of sess by 1, hence reference count of sess becomes
    zero and session gets deleted). Fix is to just send response in case
    of tmr from function "ft_queue_resp_code" and not delete "ft_cmd"
    (means don't call ft_free_cmd). Earlier code was to send the response
    code and also free ft_cmd. ft_free_cmd will be freed later after
    sending response code as a result of "transport_cmd_check_stop" (which
    calls ft_release_cmd -> ft_free_cmd) being called from
    "transport_generic_do_tmr" after sening TMR response code.
    
    Notes/Dependencies: This bug was found after fixing NULL pointer
    access issue in TCM core (in LUN Reset codepath)
    Signed-off-by: default avatarKiran Patil <kiran.patil@intel.com>
    Signed-off-by: default avatarRobert Love <robert.w.love@intel.com>
    Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
    f2f7b09c
tfc_cmd.c 18.1 KB